The 2023 tax season is now behind us, and thankfully it was a bit smoother than the previous two seasons with all of their pandemic-related issues. Unfortunately, one issue that did not go away this year is that of tax-related identity theft. This occurs when criminals use your personal information including your social security number to file a tax return to claim a fraudulent refund.
In fact, several of our clients and their dependents were victims of identity theft this season. As anyone who has ever experienced this can attest, it is a big headache and can take a lot of time and energy to resolve. In the interest of helping people avoid the stress of being a victim of tax-related identity theft, we will share a few preventative steps you can take to protect yourself.
Get An Identity Protection PIN
The first step to protecting yourself against tax-related identity theft is to get an identity protection PIN from the IRS. This is something you can do not only for yourself but also for your spouse and dependents, as long as they can pass the identity verification process.
The easiest way to get an IP PIN is to use the online Get an IP PIN tool. Alternate methods include filing an application or applying in person.
An IP PIN is valid for one calendar year. The six-digit code is used by either yourself or the tax professional filing a return on your behalf. It allows the IRS to know that it is actually you filing the return, and not a criminal trying to claim a fraudulent refund.
Essentially, having an IP PIN means that even if all of your personal information including your social security number was exposed in a data breach, someone would not be able to use that information to file a fraudulent tax return for you.
Secure Your Accounts
After obtaining an IP PIN from the IRS, the next step to protect yourself against tax-related identity theft is to make sure your online accounts are secure. This includes social media accounts, email accounts, online banking and credit card accounts, and accounts at various online retailers you do business with. Steps to secure these accounts include:
- Always use two-factor authentication when it is available.
- Using unique passwords for each account—use a password management tool to help you keep track of your passwords.
- Treat every account as a possible point of vulnerability for identity theft, not just accounts related to personal finance.
Maintain Vigilance Against Phishing Attacks
Once you have secured your accounts with unique passwords and two-factor authentication, keep them secured by keeping an eye out for phishing attacks. This is when a hacker sends you a message of some kind that they think is likely to generate a response or action which will either divulge personal information or cause you to inadvertently download malicious software.
These attacks are getting more and more sophisticated and can be difficult to spot even for savvy internet users. Examples of methods used in phishing attacks include:
Sending an email supposedly updating you about an online order from a random retailer, which you never placed—the intent being to get you to click on a link to “view details” about the order, which would actually cause malware to be downloaded to your computer.
- Posing as the customer support department of widely used companies like Amazon, Facebook, or Google, and sending a message trying to get you to take “urgent action” related to your account.
- Sending an email posing as your employer from a spoofed email address that appears to be an email at your company but is actually an email address controlled by the hacker.
- These are just a few of examples of Phishing scams—you can see many more examples here.
Know the Signs of Tax-related Identity Theft
Lastly, it is important to know the signs of tax-related identity theft so that you can take quick action if it occurs in order to limit the damage. Here are some things to look out for:
- You receive official communication from the IRS related to an action you did not take (such as filing a tax return, creating an online account, requesting a tax transcript, etc).
- You try to file a tax return but are unable to do so because of a duplicate social security number.
- IRS records indicate that you received wages from a company you never worked for..
- You are assigned an EIN number by the IRS even though you did not request one.
If any of these things occur, respond immediately by calling the number provided on the IRS notice. One complicating factor here is that there are also scammers trying to impersonate the IRS, so make sure you only respond to legitimate IRS communications and not to scams. The IRS will always make the first communication about any issue via a letter sent through the US postal service in an official government envelope containing the IRS logo. The letter will contain a notice number or letter number on the top or bottom right corner.
Consider Using Credit Monitoring and Identity Theft Protection Services
Unfortunately, despite taking all of the steps outlined above, in this era of corporate data breaches it is still possible that you might be the victim of identity theft, tax-related or otherwise. To prepare for this, you may want to consider signing up for credit monitoring and/or identity theft protection services.
There are quite a few options for these services and a detailed guide to choosing one is outside the scope of this article. In general, look for services with good reviews, recommendations from trusted organizations, and that provide assistance in not only alerting you to identity theft but also assistance in responding to it and recovering your identity.
IRS Resources Related to Identity Theft
The government has many resources related to the issue of identity theft. Here are some places to get more information about the subject:
- FAQs about the IP PIN
- Taxpayer Guide to Identity Theft
- The “Taxes, Security, Together” page on the IRS website
- The IdentityTheft.gov website operated by the FTC.